Getting Data In

How to delete a sourcetype from one of my indexes?

newbiesplunk
Path Finder

Hi,

I have two sourcetypes forwarded to an index, but I just want to delete one of the sourcetypes from this index. What is the approach? thks

Tags (3)
0 Karma

gyslainlatsa
Motivator

hi newbiesplunk ,
if your index has one sourcetype , you can remove once the index using the next command splunk clean -index ‹indexname›

0 Karma

satishsdange
Builder

You won't able to delete partial data once data is indexed. Either you have to clean index data or follow above recommendation.

0 Karma

gyslainlatsa
Motivator

hi,
your index How sourcetype?
please forgive my english

0 Karma

newbiesplunk
Path Finder

hi, i saw there is a rebuild index function (splunk rebuild ), can i use for my case? thks

0 Karma

kml_uvce
Builder

use this search

index=indexname sourcetype=sourecetypename|delete

this will not delete the data from the sourcetype but you will not see any data from this sourcetype in search

newbiesplunk
Path Finder

Hi, I know this search but i need to remove it permanently from the index, what will be the advise? thks

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

When you delete the data via the | delete command, this marks the buckets as unsearchable and this data will be aged out via the retention period of the index.

Aside from this, you need to modify your inputs to make sure that data source isnt sent to this index anymore.

Why isnt this sufficient for your use case? Data will not be visible to user or available to search, so for all intensive purposes, the data is deleted.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...